As per upstream announce at:
https://docs.openstack.org/security-notes/OSSN-0111.html

Summary
~~~~~~~
The LUKS inspector in oslo.utils can log cryptographic material when it
inspects a LUKSv1 image with a passphrase. This can expose enough key
material to decrypt the image.



Affected Services / Software
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- oslo.utils ('>=10.1.0 <10.3.0')


Discussion
~~~~~~~~~~
The issue affects deployments only when all of the following are true:

- oslo.utils 10.1.0 or later is deployed.
- The LUKS inspector is called with a passphrase.
- DEBUG logging is enabled for ``oslo_utils.imageutils._luks``.
- The resulting logs are retained or accessible to an unintended party.

The following are logged:

- part of the PBKDF2-derived key
- decrypted LUKS key material
- the full LUKS master-key candidate
- the computed and expected master-key digests

The LUKS passphrase itself is not logged.

When the passphrase passed to the LUKS inspector is correct, the
master-key candidate generated by the inspector (and logged) can decrypt
the LUKSv1 image. Anyone with access to the logs and a copy of the
encrypted image may therefore recover its plaintext contents.



Recommended Actions
~~~~~~~~~~~~~~~~~~~
Upgrade to a release containing the fix.

If upgrading is not immediately possible, raise the log level for the
``oslo_utils.imageutils._luks`` logger above DEBUG until upgraded. This
can be done without a code change by adding an entry to the
``default_log_levels`` option under ``[DEFAULT]`` in the affected
service's configuration file, for example::

  [DEFAULT]
  default_log_levels = oslo_utils.imageutils._luks=INFO,<existing defaults...>

Note that ``default_log_levels`` replaces the service's built-in default
list rather than appending to it, so include the service's existing
default loggers alongside this entry.

Restrict access to logs, log archives, centralized logging systems, and
backups.

Review retained logs for previously logged LUKS key material.

If exposure is confirmed, re-encrypt affected images with a new master
key or replace them. Applying the fix does not invalidate a key that was
already logged.

**Patches**

- master: https://review.opendev.org/1011661


**Credits:** Abhishek Kekane, Red Hat


Contacts / References
~~~~~~~~~~~~~~~~~~~~~
**Author:** Abhishek Kekane, Red Hat


* This OSSN : https://docs.openstack.org/security-notes/OSSN-0111.html
* Original LaunchPad Bug : https://bugs.launchpad.net/oslo.utils/+bug/2171574
* Fix : https://review.opendev.org/c/openstack/oslo.utils/+/1011661
* Mailing List : openstack-discuss@lists.openstack.org
* OpenStack Security : https://security.openstack.org/

We believe that the bug you reported is fixed in the latest version of
python-oslo.utils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151658@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated python-oslo.utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 23:20:02 +0200
Source: python-oslo.utils
Architecture: source
Version: 10.2.0-4
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1151658
Changes:
 python-oslo.utils (10.2.0-4) unstable; urgency=high
 .
   * OSSN-0111: Stop logging LUKS key material in the LUKS inspector,
     which could expose enough key material to decrypt LUKSv1 images
     when DEBUG logging is enabled (Closes: #1151658):
     - OSSN-0111_Stop-logging-LUKS-key-material.patch
Checksums-Sha1:
 267c1cf0007cff1e844bdda416beed07e0449588 2809 python-oslo.utils_10.2.0-4.dsc
 9fa5af727f163b34889025188c2dd96fafe8bf3d 7580 python-oslo.utils_10.2.0-4.debian.tar.xz
 ef817a20de30294cb99a2381665e9d57b174b429 11546 python-oslo.utils_10.2.0-4_amd64.buildinfo
Checksums-Sha256:
 041ee36642f38a85a44b791ad0c9df648c445477f9c53fd342639a08fa5fb344 2809 python-oslo.utils_10.2.0-4.dsc
 af842fb86e517f7c91e42a25807d926304a1587431502e2132deec2fb9d37e41 7580 python-oslo.utils_10.2.0-4.debian.tar.xz
 ffc56c7f4322145e47ac0f8a5ad315880613e5a3fe0412827301fec2f18d0814 11546 python-oslo.utils_10.2.0-4_amd64.buildinfo
Files:
 b8af7a11405d5f4d616725bdf7b40716 2809 python optional python-oslo.utils_10.2.0-4.dsc
 351c5a02dd43b584a56df201fe2f70a0 7580 python optional python-oslo.utils_10.2.0-4.debian.tar.xz
 b10c59f3a625ae008255b616c91792c1 11546 python optional python-oslo.utils_10.2.0-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmraf7sACgkQ1BatFaxr
Q/51QQ/9E29FwVDpJSWfJ+0nFvvtJvkuN9caeCoG83N1dGEV+5ASAtvZsQWAYmQY
GlZ4ZiTXOMNSdtrfyEqA0qu/tCj5A6XjLG5PJih98wgSDLwrx70czoXDZ3ZgodWg
vtW3i+VudRe64QsVn8cWZjUSM8kbLZiKN7kW3XByKQZHxk+wlVi94D64uXtRA+AZ
iVsLKjzdOInm/931XzLV04io5p5XSKl8NjUwOI32WNynGxri4GsP0kEj7SePSUSd
tpOye3Xxau5mXmHIKVa4qYeE2U+VJUPkKFDIZOxZ26HzWMpw4Lr8IKfSPlfEj/dK
zwkl6mzDLNGwFBG8/0/44RyKMXvzU1XAQ0J4zX9eKD7jiVmBDo4udB3335mOnaDn
0Pf0YnX+vXdznQ+6XWAKf2q++x73t35IE9o+KPo6jOhsVFRNunJ9ITHO+bguK0CL
yyvuNtV4AcwTqeMdmeTNPb2Wthf9eYcLjVIAVIaKH+POBQ9ugsKBOyNFxGnVcwBv
+VvT/SSDRZsAsWi5F8aUSNVM1DQ/bkHM6PAbPdCCSHC9cO3BvrEFCnXrgfZtQH9h
hsR8FZKucpx8JEhTYgkXLq48/2MOjn13b069tiwPGaW1Qv3GFax48o5hJMzgmGWv
KujygR5wXbvk0ow1ikXkTBX4p9LfVEAQz+T1+JRdKrpU8Zt9cZk=
=MbU7
-----END PGP SIGNATURE-----